Last Updated: September 24, 2026
1. Introduction
Welcome to Lume by Hareem Fatima (“Lume,” “we,” “our,” or “us”). We are committed to protecting your privacy and handling your personal information with transparency, care, and respect.
This Privacy Policy explains how we collect, use, share, store, and protect your personal information when you visit www.lumebyhf.com (the “Website”), purchase our products—including handbags, sunblock, moisturizer, and perfume—or otherwise interact with us.
By using our Website or purchasing our products, you agree to the collection and use of your information in accordance with this Privacy Policy. If you do not agree, please do not use our Website or services.
2. Who We Are
Brand Name: Lume by Hareem Fatima
Website: www.lumebyhf.com
Product Categories: Lume Carry (handbags), Lume Nourish (moisturizers/skincare), Lume Shield (sunblock/sun care), Lume Scent (perfume/fragrance)
Contact Email: [email protected]
For the purposes of applicable data protection laws, Lume by Hareem Fatima is the data controller responsible for your personal information.
3. Information We Collect
We collect the following categories of personal information:
3.1 Information You Provide Directly
- Identity Data: Full name, username, title
- Contact Data: Email address, phone number, shipping address, billing address
- Payment Data: Credit/debit card details, bank account information, or other payment method details (processed securely by third-party payment processors)
- Order Data: Details of products purchased, order history, returns, and refunds
- Communication Data: Messages you send us via email, contact forms, live chat, or social media
- Account Data: Login credentials if you create an account on our Website
- Marketing Preferences: Your preferences for receiving marketing communications
3.2 Information Collected Automatically
- Technical Data: IP address, browser type and version, time zone setting, browser plug-in types, operating system and platform
- Usage Data: Information about how you use our Website, products, and services
- Device Data: Device identifiers, mobile network information
- Location Data: Approximate location based on IP address
- Cookie Data: Information collected through cookies, pixel tags, and similar tracking technologies (see Section 8)
3.3 Information from Third Parties
- Payment processors and fraud prevention services
- Delivery and logistics partners
- Social media platforms (if you interact with us through social media)
- Analytics providers
4. How We Collect Your Information
We collect personal information through:
- Direct Interactions: When you create an account, place an order, subscribe to our newsletter, contact customer service, or participate in promotions
- Automated Technologies: Cookies, server logs, and similar technologies when you browse our Website
- Third Parties: Payment processors, delivery partners, analytics providers, and advertising networks
5. How We Use Your Information
We use your personal information for the following purposes:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Processing and fulfilling your orders | Performance of a contract |
| Managing your account and providing customer support | Performance of a contract |
| Sending order confirmations, shipping updates, and receipts | Performance of a contract |
| Processing payments and preventing fraud | Legitimate interest / Legal obligation |
| Sending marketing communications (with your consent) | Consent |
| Personalizing your shopping experience | Legitimate interest |
| Improving our Website, products, and services | Legitimate interest |
| Complying with legal obligations | Legal obligation |
| Resolving disputes and enforcing our agreements | Legitimate interest |
| Conducting analytics and market research | Legitimate interest / Consent |
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason compatible with the original purpose.
6. Sharing Your Information
We do not sell your personal information. We may share your information with:
- Service Providers: Payment processors, shipping and delivery partners, IT and website hosting providers, email marketing platforms, and customer support tools
- Professional Advisers: Lawyers, accountants, auditors, and insurers
- Analytics and Advertising Partners: Google Analytics, Meta (Facebook/Instagram), and similar platforms (with your consent where required)
- Legal Authorities: When required by law, court order, or to protect our legal rights
- Business Transfers: In connection with a merger, acquisition, or sale of assets
All third-party service providers are required to respect the security of your personal information and to treat it in accordance with applicable law.
7. International Data Transfers
Your personal information may be transferred to, stored, and processed in countries outside your country of residence, including countries where our service providers operate.
Where we transfer personal information from the European Economic Area (EEA), the United Kingdom, or Switzerland to countries not deemed adequate, we use appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.
For customers in Pakistan, personal data may be processed on servers located within Pakistan or transferred to authorized persons in accordance with applicable laws. Critical personal data may only be processed on servers located within Pakistan.
8. Cookies and Tracking Technologies
We use cookies, pixel tags, and similar technologies to:
- Keep you logged in and remember your preferences
- Understand how you use our Website
- Personalize your experience
- Deliver targeted advertising
- Measure the effectiveness of our marketing campaigns
Types of cookies we use:
- Strictly Necessary Cookies: Required for the Website to function
- Performance Cookies: Help us analyze how visitors use our Website
- Functionality Cookies: Remember your preferences
- Targeting/Advertising Cookies: Deliver relevant ads to you
You can manage your cookie preferences through your browser settings. For more information, please see our Cookie Policy [link to Cookie Policy].
Under the GDPR and ePrivacy Directive, we obtain your active, informed consent for non-essential cookies. You may withdraw your consent at any time.
9. Data Security
We implement appropriate technical and organizational security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of sensitive data (SSL/TLS)
- Secure payment processing (PCI-DSS compliant)
- Access controls and authentication
- Regular security assessments
- Employee training on data protection
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.
10. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes for which we collected it, including:
- Order and transaction data: 7 years (for tax and accounting purposes)
- Account data: Until you delete your account or request deletion
- Marketing data: Until you withdraw consent or unsubscribe
- Analytics data: Up to 26 months
When we no longer need your personal information, we securely delete or anonymize it.
11. Your Rights
Depending on your location, you may have the following rights regarding your personal information:
11.1 Rights Under GDPR (EEA, UK, Switzerland)
- Right to Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data (“right to be forgotten”)
- Right to Restrict Processing: Limit how we use your data
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent at any time
- Right to Lodge a Complaint: File a complaint with your local supervisory authority
11.2 Rights Under CCPA/CPRA (California Residents)
- Right to Know: What personal information we collect, use, and share
- Right to Delete: Request deletion of your personal information
- Right to Opt-Out: Opt out of the “sale” or “sharing” of personal information
- Right to Correct: Correct inaccurate personal information
- Right to Limit Use of Sensitive Personal Information
- Right to Non-Discrimination: We will not discriminate against you for exercising your rights
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days (or 45 days for CCPA requests).
11.3 Rights Under Pakistan Data Protection Framework
Under the Constitution of Pakistan (Article 14) and the draft Personal Data Protection Bill, 2023, you have rights to access, correct, and request deletion of your personal data. We are committed to upholding these rights in accordance with applicable law.
12. Do Not Track Signals
We honor “Do Not Track” (DNT) signals and Global Privacy Controls (GPC) where required by law. When enabled, we will not track your browsing behavior for advertising purposes.
13. Children’s Privacy
Our Website and products are not intended for children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately, and we will take steps to delete such information.
14. Third-Party Links
Our Website may contain links to third-party websites, plug-ins, and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.
15. Marketing Communications
We may send you marketing communications if:
- You have opted in to receive them
- You have purchased from us and have not opted out
- We are permitted to do so by law
You can unsubscribe from marketing communications at any time by:
- Clicking the “unsubscribe” link in any marketing email
- Contacting us at [email protected]
- Updating your preferences in your account settings
We will not send you marketing communications after you have opted out, but we may still contact you regarding your orders or account.
16. Business Transfers
If Lume by Hareem Fatima is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Website of any change in ownership or use of your personal information.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated policy on this page with a new “Last Updated” date.
We encourage you to review this Privacy Policy periodically. Your continued use of our Website after any changes constitutes acceptance of the updated policy.
18. How to Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: [email protected]
Website: www.lumebyhf.com
For customers in the European Union, you have the right to lodge a complaint with your local data protection authority. For customers in California, you may contact the California Attorney General’s office.
By using www.lumebyhf.com, you acknowledge that you have read and understood this Privacy Policy.